← Vulnerability Intelligence

CVE-2010-1871

High 8.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Metrics

CVSS 3.1
8.8 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — exploit probability
83% (percentile: 100) as of 1 November 2026
CWE
CWE-917

Affected products

redhat: jboss enterprise application platform; redhat: enterprise linux; netapp: oncommand balance; netapp: oncommand insight; netapp: oncommand unified manager

References